CVE-2026-115570

The record

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromium networking, Node.js tls, Node.js https, or Node.js fetch. An attacker who holds a certificate issued through one of these intermediates and can intercept network traffic can impersonate a TLS server to an affected application. This issue is fixed in versions 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6.

Affected packages

Related vulnerabilities

• CVE-2026-118696 In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3… CWE-299
• CVE-2026-115557 Python has added a denylist for known compromised certificates to the "ssl" module to… CWE-299
• CVE-2026-111943 On most platforms, Go uses the given system root certificates. CWE-299
• CVE-2026-86231 A security flaw has been discovered in mwiede jsch up to 2.28.5. CWE-299
• CVE-2026-61699 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. CWE-299
• CVE-2026-56821 Netty is an asynchronous, event-driven network application framework. CWE-299
• CVE-2026-9636 A security issue exists within CompactLogix® 5380, ControlLogix® 5580, and EN4… CWE-299
• CVE-2026-6899 Check for certificate revocation only considers the first matching CRL and ignores other… CWE-299